@agenthippo-ai/agenthippo 0.1.0 → 0.2.3-dataplane

package/out/analytics/sessionEvents.js

@@ -126,13 +126,25 @@ class ObservableStreamEmitter {
     writer;
     sessionId;
     requestId;
+    userId;
     missingCallIdCounter = 0;
     pendingSyntheticCallIds = new Map();
-    constructor(inner, writer, sessionId, requestId) {
+    constructor(inner, writer, sessionId, requestId, 
+    /**
+     * Acting user for the warrant audit trail on tool events. Captured once at
+     * wrap time (still inside the request's credential scope) and stored on this
+     * per-turn emitter — never re-read from ambient AsyncLocalStorage at emit
+     * time. Custom-engine persistent workers deliver tool events on a detached
+     * parent IPC callback whose ALS can stick to the spawn request; constructor
+     * capture keeps attribution correct for every engine. Undefined outside a
+     * serve credential scope (IDE-local / CLI without runWithCredential).
+     */
+    userId) {
         this.inner = inner;
         this.writer = writer;
         this.sessionId = sessionId;
         this.requestId = requestId;
+        this.userId = userId;
     }
     makeCallIdKey(toolName) {
         return `${this.sessionId}:${this.requestId}:${toolName}`;
@@ -175,6 +187,8 @@ class ObservableStreamEmitter {
             callId: loggedCallId,
             // Truncate input to avoid huge JSONL files
             inputPreview: input?.slice(0, 500),
+            // The warrant: who this tool call ran as (captured at wrap; see constructor).
+            userId: this.userId,
         });
         return this.inner.toolStart(toolName, input, toolCallId, metadata);
     }
@@ -188,6 +202,7 @@ class ObservableStreamEmitter {
             isError: isError ?? false,
             // Truncate result to avoid huge JSONL files
             resultPreview: result?.slice(0, 500),
+            userId: this.userId,
         });
         return this.inner.toolEnd(toolName, toolCallId, result, isError, metadata);
     }
@@ -200,6 +215,7 @@ class ObservableStreamEmitter {
     async error(message) {
         await this.writer.append(this.sessionId, this.requestId, 'error', {
             message,
+            userId: this.userId,
         });
         return this.inner.error(message);
     }
@@ -210,7 +226,7 @@ class ObservableStreamEmitter {
      * Emit a turn_start event. Call at the beginning of stream().
      */
     async emitTurnStart() {
-        await this.writer.append(this.sessionId, this.requestId, 'turn_start', {});
+        await this.writer.append(this.sessionId, this.requestId, 'turn_start', { userId: this.userId });
     }
     /**
      * Emit a turn_end event. Call at the end of stream().
@@ -218,6 +234,7 @@ class ObservableStreamEmitter {
     async emitTurnEnd(success) {
         await this.writer.append(this.sessionId, this.requestId, 'turn_end', {
             success,
+            userId: this.userId,
         });
     }
 }
@@ -226,6 +243,6 @@ exports.ObservableStreamEmitter = ObservableStreamEmitter;
  * Create an ObservableStreamEmitter that wraps the given emitter.
  * Returns both the wrapped emitter and emit helpers for turn boundaries.
  */
-function wrapEmitterWithObservability(inner, writer, sessionId, requestId) {
-    return new ObservableStreamEmitter(inner, writer, sessionId, requestId);
+function wrapEmitterWithObservability(inner, writer, sessionId, requestId, userId) {
+    return new ObservableStreamEmitter(inner, writer, sessionId, requestId, userId);
 }

package/out/auth/brokerClient.js

@@ -118,7 +118,7 @@ function buildAuthorizeUrl(baseUrl, redirectUri, codeChallenge, state, loginHint
     }
     return url.toString();
 }
-async function completeDevPkceLogin(baseUrl, email, redirectUri = 'agenthippo://auth/callback') {
+async function completeDevPkceLogin(baseUrl, email, redirectUri = 'http://127.0.0.1:1/callback') {
     const verifier = (0, pkce_js_1.generateCodeVerifier)();
     const challenge = (0, pkce_js_1.codeChallengeFromVerifier)(verifier);
     const code = await devLoginForTests(baseUrl, email, redirectUri, challenge);

package/out/auth/onboardingPrompt.js

@@ -0,0 +1,112 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.showSignInOnboardingPromptIfNeeded = showSignInOnboardingPromptIfNeeded;
+exports.scheduleSignInOnboardingPrompt = scheduleSignInOnboardingPrompt;
+const vscode = __importStar(require("vscode"));
+const sessionStore_js_1 = require("./sessionStore.js");
+const PROMPT_DISMISSED_KEY = 'agentide.signInPrompt.dismissed';
+const PROVIDERS_LIST_KEY = 'agentide.providers';
+const API_KEY_PREFIX = 'agentide.apikey.';
+const OAUTH_PREFIX = 'agentide.oauth.';
+const ONBOARDING_MESSAGE = 'BYOK or Sign in for instant model access — no API key needed.';
+async function hasByokConfigured(secrets) {
+    const providersJson = await secrets.get(PROVIDERS_LIST_KEY);
+    if (!providersJson) {
+        return false;
+    }
+    try {
+        const providers = JSON.parse(providersJson);
+        if (!Array.isArray(providers)) {
+            return false;
+        }
+        for (const provider of providers) {
+            if (provider === 'agenthippo') {
+                continue;
+            }
+            const apiKey = await secrets.get(`${API_KEY_PREFIX}${provider}`);
+            if (apiKey?.trim()) {
+                return true;
+            }
+            const oauth = await secrets.get(`${OAUTH_PREFIX}${provider}`);
+            if (oauth?.trim()) {
+                return true;
+            }
+        }
+    }
+    catch {
+        // ignore malformed provider list
+    }
+    return false;
+}
+async function shouldShowOnboardingPrompt(context) {
+    if (context.globalState.get(PROMPT_DISMISSED_KEY)) {
+        return false;
+    }
+    if (await (0, sessionStore_js_1.getStoredAuthSession)(context.secrets)) {
+        return false;
+    }
+    if (await hasByokConfigured(context.secrets)) {
+        return false;
+    }
+    return true;
+}
+async function showSignInOnboardingPromptIfNeeded(context) {
+    if (!(await shouldShowOnboardingPrompt(context))) {
+        return;
+    }
+    const choice = await vscode.window.showInformationMessage(ONBOARDING_MESSAGE, 'Sign In', 'Add API Key', 'Later');
+    if (choice === 'Sign In') {
+        await vscode.commands.executeCommand('agenthippo.signIn');
+        return;
+    }
+    if (choice === 'Add API Key') {
+        await vscode.commands.executeCommand('agentide.addAPIKey');
+        return;
+    }
+    if (choice === 'Later' || choice === undefined) {
+        await context.globalState.update(PROMPT_DISMISSED_KEY, true);
+    }
+}
+/** Delay so the workbench finishes restoring before the toast appears. */
+function scheduleSignInOnboardingPrompt(context) {
+    const handle = setTimeout(() => {
+        void showSignInOnboardingPromptIfNeeded(context);
+    }, 3000);
+    context.subscriptions.push({ dispose: () => clearTimeout(handle) });
+}

package/out/auth/provider.js

@@ -48,7 +48,7 @@ const signInFlow_js_1 = require("./signInFlow.js");
 const sessionStore_js_1 = require("./sessionStore.js");
 var sessionStore_js_2 = require("./sessionStore.js");
 Object.defineProperty(exports, "getAgentHippoAccessToken", { enumerable: true, get: function () { return sessionStore_js_2.getAgentHippoAccessToken; } });
-const DEFAULT_AGENTHIPPO_MODEL_GATEWAY_URL = 'https://api.agenthippo.ai/v1';
+const DEFAULT_AGENTHIPPO_MODEL_GATEWAY_URL = 'https://gateway.agenthippo.ai/v1';
 function getAgentHippoModelGatewayUrl() {
     return vscode.workspace.getConfiguration('agentide').get('AgentHippoModelGateway.url')?.trim() || DEFAULT_AGENTHIPPO_MODEL_GATEWAY_URL;
 }

package/out/auth-broker/config.js

@@ -3,7 +3,7 @@
  *  Copyright (c) AgentHippo.ai. All rights reserved.
  *--------------------------------------------------------------------------------------------*/
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_JWT_SECRET = void 0;
+exports.DEFAULT_LITELLM_API_KEY = exports.DEFAULT_JWT_SECRET = void 0;
 exports.loadAuthBrokerConfig = loadAuthBrokerConfig;
 exports.emailDomainAllowed = emailDomainAllowed;
 function parseDomains(raw) {
@@ -14,6 +14,8 @@ function parseDomains(raw) {
 }
 /** Well-known default secret used in dev/test. Never acceptable in production. */
 exports.DEFAULT_JWT_SECRET = 'dev-agenthippo-auth-secret-change-me';
+/** Well-known default LiteLLM team key used in dev/test. Never acceptable in production. */
+exports.DEFAULT_LITELLM_API_KEY = 'ahk_team_dev_key';
 function loadAuthBrokerConfig(env = process.env) {
     const jwtSecret = env.AGENTHIPPO_AUTH_JWT_SECRET?.trim() || exports.DEFAULT_JWT_SECRET;
     const publicBaseUrl = (env.AGENTHIPPO_AUTH_PUBLIC_URL?.trim() || `http://127.0.0.1:${env.AGENTHIPPO_AUTH_PORT?.trim() || '9780'}`).replace(/\/+$/, '');
@@ -27,7 +29,10 @@ function loadAuthBrokerConfig(env = process.env) {
         accessTokenTtlSec: Number(env.AGENTHIPPO_AUTH_ACCESS_TTL_SEC || 3600),
         refreshTokenTtlSec: Number(env.AGENTHIPPO_AUTH_REFRESH_TTL_SEC || 30 * 24 * 3600),
         allowedEmailDomains: parseDomains(env.AGENTHIPPO_AUTH_ALLOWED_DOMAINS),
-        devMode: env.AGENTHIPPO_AUTH_DEV === '1' || env.NODE_ENV === 'test',
+        // Deliberately not gated on NODE_ENV=test: that value is too easy to inherit by accident
+        // (test runners, base images, wrapper scripts) and this flag unlocks an unauthenticated
+        // login bypass (/oauth/dev/login, login_hint auto-auth) — require the explicit opt-in.
+        devMode: env.AGENTHIPPO_AUTH_DEV === '1',
         rateLimitPerMin: env.AGENTHIPPO_AUTH_RATE_LIMIT !== undefined ? Number(env.AGENTHIPPO_AUTH_RATE_LIMIT) : 60,
         logPii: env.AGENTHIPPO_AUTH_LOG_PII === '1',
         cookieName: env.AGENTHIPPO_AUTH_COOKIE_NAME?.trim() || 'ah_token',
@@ -41,7 +46,7 @@ function loadAuthBrokerConfig(env = process.env) {
             storeIndexUrl: env.AGENTHIPPO_TEAM_STORE_INDEX_URL?.trim() || `https://${storeOwner}.github.io/${storeName}`,
             githubOrg: env.AGENTHIPPO_TEAM_GITHUB_ORG?.trim() || storeOwner,
             litellmBaseUrl: env.AGENTHIPPO_TEAM_LITELLM_BASE_URL?.trim() || 'http://127.0.0.1:4000',
-            litellmApiKey: env.AGENTHIPPO_TEAM_LITELLM_API_KEY?.trim() || 'ahk_team_dev_key',
+            litellmApiKey: env.AGENTHIPPO_TEAM_LITELLM_API_KEY?.trim() || exports.DEFAULT_LITELLM_API_KEY,
         },
     };
 }

package/out/auth-broker/pkce.js

@@ -53,5 +53,7 @@ function codeChallengeFromVerifier(verifier) {
     return crypto.createHash('sha256').update(verifier).digest('base64url');
 }
 function verifyPkceChallenge(verifier, challenge) {
-    return codeChallengeFromVerifier(verifier) === challenge;
+    const expected = Buffer.from(codeChallengeFromVerifier(verifier));
+    const actual = Buffer.from(challenge);
+    return expected.length === actual.length && crypto.timingSafeEqual(expected, actual);
 }

package/out/auth-broker/server.js

@@ -47,7 +47,29 @@ const store_js_1 = require("./store.js");
 const pkce_js_1 = require("./pkce.js");
 const jwt_js_1 = require("./jwt.js");
 const types_js_1 = require("../auth/types.js");
+const callbackUriParse_js_1 = require("../auth/callbackUriParse.js");
 const serve_hardening_js_1 = require("../cli/serve-hardening.js");
+/**
+ * Restrict `redirect_uri` to the shapes our own clients actually send — the CLI/IDE loopback
+ * callback (127.0.0.1/localhost, any OS-assigned port, see loopbackAuthServer.ts) and the IDE
+ * URI-scheme callback (any editor scheme, fixed authority+path, see callbackUri.ts). Without
+ * this, `/oauth/authorize` would hand a real auth code to whatever `redirect_uri` a caller
+ * supplies — an attacker can send a victim (who has an active SSO session) a link with their
+ * own redirect_uri and code_challenge and steal the resulting code via their own server.
+ */
+function isAllowedRedirectUri(redirectUri) {
+    let target;
+    try {
+        target = new url_1.URL(redirectUri);
+    }
+    catch {
+        return false;
+    }
+    if (target.protocol === 'http:') {
+        return (target.hostname === '127.0.0.1' || target.hostname === 'localhost') && target.pathname === '/callback';
+    }
+    return (0, callbackUriParse_js_1.isAuthCallbackParts)(target.host, target.pathname);
+}
 function sendJson(res, status, body) {
     res.writeHead(status, { 'Content-Type': 'application/json' });
     res.end(JSON.stringify(body));
@@ -114,6 +136,9 @@ function extractCookieToken(cookieHeader, name) {
 function safeReturnTo(rawReturnTo, cookieDomain, fallback) {
     try {
         const target = new url_1.URL(rawReturnTo);
+        if (target.protocol !== 'http:' && target.protocol !== 'https:') {
+            return fallback;
+        }
         if (cookieDomain) {
             const parent = cookieDomain.replace(/^\./, '').toLowerCase();
             if (target.hostname.toLowerCase() === parent || target.hostname.toLowerCase().endsWith('.' + parent)) {
@@ -136,6 +161,12 @@ function createAuthBrokerServer(config) {
         throw new Error('AGENTHIPPO_AUTH_JWT_SECRET must be set to a strong secret in production. ' +
             'Generate one with: openssl rand -hex 32');
     }
+    // Fail-closed: a known-default LiteLLM key would hand every team member the same
+    // publicly-known credential if the operator forgot to set the real one.
+    if (!resolved.devMode && resolved.team.litellmApiKey === config_js_1.DEFAULT_LITELLM_API_KEY) {
+        throw new Error('AGENTHIPPO_TEAM_LITELLM_API_KEY must be set in production. ' +
+            'The default dev key must not be issued to real users via bootstrap.');
+    }
     // Warn when no domain restriction is configured: any SSO-authenticated email can sign in.
     if (!resolved.devMode && resolved.allowedEmailDomains.length === 0) {
         console.warn('[auth-broker] Warning: AGENTHIPPO_AUTH_ALLOWED_DOMAINS is not set — ' +
@@ -256,6 +287,11 @@ function createAuthBrokerServer(config) {
                     sendJson(res, 400, { error: 'invalid_request' });
                     return;
                 }
+                if (!isAllowedRedirectUri(redirectUri)) {
+                    audit('authorize.invalid_redirect_uri', { client_id: clientId });
+                    sendJson(res, 400, { error: 'invalid_request', error_description: 'redirect_uri not allowed' });
+                    return;
+                }
                 // Dev mode with explicit login_hint: auto-authenticate (backward compat for tests).
                 if (resolved.devMode && loginHint) {
                     const user = store.upsertUser(loginHint);
@@ -508,10 +544,16 @@ function createAuthBrokerServer(config) {
             sendJson(res, 404, { error: 'not_found' });
         }
         catch (err) {
-            if (err.status === 413) {
+            const status = err.status;
+            if (status === 413) {
                 sendJson(res, 413, { error: 'request_entity_too_large' });
                 return;
             }
+            if (status === 403) {
+                audit('forbidden', { reason: 'email_domain' });
+                sendJson(res, 403, { error: 'forbidden', error_description: 'email domain not allowed' });
+                return;
+            }
             // Log the real error internally; return a generic message so clients don't see
             // stack fragments / internal paths in the 500 body.
             console.error('[auth-broker] internal error', err);

package/out/auth-broker/store.js

@@ -123,7 +123,9 @@ class AuthBrokerStore {
     upsertUser(email, displayName) {
         const normalized = email.trim().toLowerCase();
         if (!(0, config_js_1.emailDomainAllowed)(normalized, this.config.allowedEmailDomains)) {
-            throw new Error(`Email domain not allowed for sign-in: ${normalized}`);
+            const err = new Error(`Email domain not allowed for sign-in: ${normalized}`);
+            err.status = 403;
+            throw err;
         }
         for (const user of this.users.values()) {
             if (user.email === normalized) {
@@ -219,7 +221,6 @@ class AuthBrokerStore {
         };
     }
     buildBootstrap(user) {
-        const expiresAt = new Date(Date.now() + this.config.accessTokenTtlSec * 1000).toISOString();
         return {
             version: 1,
             user: {
@@ -240,7 +241,8 @@ class AuthBrokerStore {
             routing: {
                 litellmBaseUrl: this.config.team.litellmBaseUrl,
                 litellmApiKey: this.config.team.litellmApiKey,
-                litellmApiKeyExpiresAt: expiresAt,
+                // No litellmApiKeyExpiresAt: the team key is static — a fabricated expiry
+                // would only pretend rotation exists. Per-user virtual keys are the upgrade path.
             },
             policy: {
                 byokAllowed: true,
@@ -249,10 +251,9 @@ class AuthBrokerStore {
         };
     }
     refreshRoutingCredentials() {
-        const litellmApiKeyExpiresAt = new Date(Date.now() + this.config.accessTokenTtlSec * 1000).toISOString();
+        // The team key is static (no rotation backend yet), so no expiry is reported.
         return {
             litellmApiKey: this.config.team.litellmApiKey,
-            litellmApiKeyExpiresAt,
         };
     }
     buildMe(user) {

package/out/cli/commands/ask.js

@@ -173,6 +173,9 @@ async function askCommand(options) {
         apiKey: apiConfig.apiKey,
         baseUrl: apiConfig.baseUrl,
         useLiteLLM: apiConfig.useLiteLLM,
+        litellmApiKey: apiConfig.litellmApiKey,
+        openaiApiKey: apiConfig.openaiApiKey,
+        anthropicApiKey: apiConfig.anthropicApiKey,
         logger,
         freshState: !options.sessionId?.trim(), // Persist native session when continuing a conversation
         permissionHandler,

package/out/cli/commands/chat.js

@@ -152,6 +152,9 @@ async function chatCommand(options) {
         apiKey: apiConfig.apiKey,
         baseUrl: apiConfig.baseUrl,
         useLiteLLM: apiConfig.useLiteLLM,
+        litellmApiKey: apiConfig.litellmApiKey,
+        openaiApiKey: apiConfig.openaiApiKey,
+        anthropicApiKey: apiConfig.anthropicApiKey,
         logger,
         freshState: false, // Persist session within REPL
         claudeCodeExecutablePath: claudeCodePath,

package/out/cli/commands/deploy.js

@@ -48,9 +48,10 @@ const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const yaml = __importStar(require("js-yaml"));
 const deploy_init_1 = require("../deploy-init");
+const registry_1 = require("../deploy/blueprints/registry");
 const utils_1 = require("../utils");
 const DEFAULT_PORT = 8080;
-/** Read pack id + engine + model from agent.yaml without the full loader (no workspace/sync needed). */
+/** Read pack id + version + engine + model from agent.yaml without the full loader (no workspace/sync needed). */
 function readManifest(packDir) {
     const manifestPath = path.join(packDir, 'agent.yaml');
     if (!fs.existsSync(manifestPath)) {
@@ -61,9 +62,14 @@ function readManifest(packDir) {
     if (!name) {
         throw new Error(`agent.yaml is missing metadata.name in ${packDir}`);
     }
+    const version = parsed?.metadata?.version?.trim();
+    if (!version) {
+        throw new Error(`agent.yaml is missing metadata.version in ${packDir}`);
+    }
     const model = parsed?.spec?.model?.trim();
     return {
         name,
+        version,
         engine: parsed?.spec?.engine?.trim() || 'claude',
         ...(model ? { model } : {}),
     };
@@ -123,7 +129,7 @@ function copyPackToStaging(packDir, stagingDir) {
                 return false;
             if (base.endsWith('.log'))
                 return false;
-            if (/credentials/i.test(base) && base.endsWith('.json'))
+            if ((0, deploy_init_1.isSecretLikeBasename)(base))
                 return false;
             return true;
         },
@@ -135,8 +141,35 @@ async function deployCommand(action, packArg, options) {
         console.error(`Unknown deploy action "${action}". Supported: init`);
         process.exit(1);
     }
+    // Blueprint resolution (PLAN/deploy.md §3) picks --target/--ingress for you; --platform
+    // selects which platform within the blueprint's supported set. Raw --target/--ingress stay
+    // fully usable when --blueprint is omitted — nothing here changes that path.
+    let resolvedTarget = options.target;
+    let resolvedIngress = options.ingress;
+    if (options.blueprint) {
+        if (!(0, registry_1.isBlueprintId)(options.blueprint)) {
+            console.error(`Unknown --blueprint "${options.blueprint}". Supported: ${Object.keys(registry_1.BLUEPRINTS).join(', ')}`);
+            process.exit(1);
+            return;
+        }
+        if (options.platform && !(0, deploy_init_1.isDeployTarget)(options.platform)) {
+            console.error(`Unknown --platform "${options.platform}". Supported: ${deploy_init_1.DEPLOY_TARGETS.join(', ')}`);
+            process.exit(1);
+            return;
+        }
+        try {
+            const resolved = (0, registry_1.resolveBlueprint)(options.blueprint, options.platform);
+            resolvedTarget = resolved.target;
+            resolvedIngress = resolved.ingress;
+        }
+        catch (err) {
+            console.error(`Error: ${err instanceof Error ? err.message : err}`);
+            process.exit(1);
+            return;
+        }
+    }
     const packDir = path.resolve(options.packdir || packArg || process.cwd());
-    const targetsRequested = options.target === 'all' ? [...deploy_init_1.DEPLOY_TARGETS] : [options.target];
+    const targetsRequested = resolvedTarget === 'all' ? [...deploy_init_1.DEPLOY_TARGETS] : [resolvedTarget];
     for (const t of targetsRequested) {
         if (!(0, deploy_init_1.isDeployTarget)(t)) {
             console.error(`Unknown --target "${t}". Supported: ${deploy_init_1.DEPLOY_TARGETS.join(', ')}, all`);
@@ -162,8 +195,14 @@ async function deployCommand(action, packArg, options) {
             }
         }
     }
+    const modelRouting = options.modelRouting === 'gateway' ? 'gateway' : options.modelRouting === 'sidecar' ? 'sidecar' : undefined;
+    if (options.modelRouting && options.modelRouting !== 'gateway' && options.modelRouting !== 'sidecar') {
+        console.error(`Unknown --model-routing "${options.modelRouting}". Supported: sidecar, gateway`);
+        process.exit(1);
+    }
     const ctx = {
         packName: manifest.name,
+        packVersion: manifest.version,
         image: options.image || (0, deploy_init_1.defaultRuntimeImage)(manifest.engine),
         port: options.port || DEFAULT_PORT,
         engine: manifest.engine,
@@ -171,18 +210,17 @@ async function deployCommand(action, packArg, options) {
         envVars,
         gatewayChannels: gateway,
         publicHostname: (0, deploy_init_1.resolveDeployPublicHostname)(options.hostname),
-        ingress: options.ingress,
+        ingress: resolvedIngress,
         idpUrl: options.idpUrl,
         cookieDomain: options.cookieDomain,
+        colocate: options.colocate,
+        modelRouting,
     };
     for (const target of targetsRequested) {
-        // Staging dir = a self-contained pack (pack content + generated deploy/). Default
-        // ./deploy-out/<pack>-<target> (cwd-relative); --out overrides (per-target subdir if
-        // multiple targets). Build context = staging root, so COPY . /app/pack/ is correct
-        // regardless of where the script is invoked from.
+        const routingSuffix = modelRouting === 'gateway' ? '-gateway' : '';
         const outDir = options.out
-            ? (targetsRequested.length > 1 ? path.join(path.resolve(options.out), target) : path.resolve(options.out))
-            : path.join(process.cwd(), 'deploy-out', `${manifest.name}-${target}`);
+            ? (targetsRequested.length > 1 ? path.join(path.resolve(options.out), target + routingSuffix) : path.resolve(options.out))
+            : path.join(process.cwd(), 'deploy-out', `${manifest.name}-${target}${routingSuffix}`);
         fs.mkdirSync(outDir, { recursive: true });
         // Copy the pack into the staging root (filtered: no VCS/caches/secrets, no source deploy/).
         const brokenLinks = copyPackToStaging(packDir, outDir);
@@ -220,4 +258,5 @@ async function deployCommand(action, packArg, options) {
         console.log(`\n${utils_1.COLORS.dim}Scanned pack secrets into .env.example: ${envVars.join(', ')}${utils_1.COLORS.reset}`);
     }
     console.log(`\nNext: cd into the staging dir above, \`cp deploy/.env.example deploy/.env\`, then run the command in deploy/README.md (scripts anchor themselves to the staging root).`);
+    console.log(`${utils_1.COLORS.dim}Tip: run deploy init from the pack's parent directory — not from inside the pack (default deploy-out/ inside the pack copies into itself and fails).${utils_1.COLORS.reset}`);
 }

package/out/cli/commands/gateway.js

@@ -60,7 +60,61 @@ async function ensureStoreFileExists(storePath) {
         process.exit(1);
     }
 }
+/**
+ * Broker-mediated send (secure-obo-design §7.6): under `agenthippo serve` with the egress
+ * broker active, the agent's env carries AGENTHIPPO_EGRESS_URL + AGENTHIPPO_TURN_NONCE but NOT
+ * the gateway token. Route the send through the broker, which resolves the destination
+ * server-side from THIS turn's bound handles and delivers with the broker-held token.
+ * `--outbound`/`--agent` are ignored here — the broker derives both from the verified nonce.
+ */
+async function sendViaEgressBroker(egressUrl, nonce, options) {
+    const message = options.message.trim();
+    if (!message) {
+        console.error('Error: --message is required');
+        process.exit(1);
+    }
+    if (options.dryRun) {
+        console.log(`${utils_js_1.COLORS.dim}Dry run (egress broker):${utils_js_1.COLORS.reset} POST ${egressUrl} { to: ${options.target ?? '(reply-to-sender)'} }`);
+        process.exit(0);
+    }
+    let res;
+    try {
+        res = await fetch(egressUrl, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${nonce}` },
+            body: JSON.stringify({ message, to: options.target?.trim() || undefined, media: options.media?.trim() || undefined }),
+        });
+    }
+    catch (err) {
+        console.error(`${utils_js_1.COLORS.red}✗${utils_js_1.COLORS.reset} Egress broker unreachable: ${err instanceof Error ? err.message : String(err)}`);
+        process.exit(1);
+    }
+    const bodyText = await res.text();
+    let body = {};
+    try {
+        body = JSON.parse(bodyText);
+    }
+    catch { /* non-JSON error body */ }
+    if (options.json) {
+        console.log(JSON.stringify({ via: 'egress-broker', status: res.status, result: body }, null, 2));
+    }
+    else if (res.ok && body.ok) {
+        console.log(`${utils_js_1.COLORS.green}✓${utils_js_1.COLORS.reset} Sent (via egress broker${body.via ? `, ${body.via}` : ''})`);
+    }
+    else {
+        console.error(`${utils_js_1.COLORS.red}✗${utils_js_1.COLORS.reset} Egress send rejected (HTTP ${res.status}): ${body.error || bodyText || 'unknown error'}`);
+        process.exit(1);
+    }
+    process.exit(res.ok && body.ok ? 0 : 1);
+}
 async function gatewaySendCommand(options) {
+    // Prefer the broker whenever serve exposes it: the agent has no gateway token to send directly.
+    const egressUrl = process.env.AGENTHIPPO_EGRESS_URL?.trim();
+    const nonce = process.env.AGENTHIPPO_TURN_NONCE?.trim();
+    if (egressUrl && nonce) {
+        await sendViaEgressBroker(egressUrl, nonce, options);
+        return;
+    }
     const storePath = resolveOutboundPath(options.outbound);
     await ensureStoreFileExists(storePath);
     const agentId = options.agent.trim();